mirror of
https://github.com/KevinMidboe/playbooks-retailor.git
synced 2026-09-24 05:39:05 +00:00
update elasticsearch w/ ssl & xpack support
This commit is contained in:
@@ -0,0 +1,147 @@
|
||||
# ansible_managed
|
||||
version: "3.8"
|
||||
|
||||
networks:
|
||||
{{ elk_network_name }}:
|
||||
driver: bridge
|
||||
ipam:
|
||||
config:
|
||||
- subnet: {{ elk_network_subnet }}
|
||||
|
||||
volumes:
|
||||
{{ elk_elasticsearch_data_volume }}:
|
||||
driver: local
|
||||
|
||||
services:
|
||||
elasticsearch:
|
||||
image: "{{ elk_docker_image_repo }}/elasticsearch/elasticsearch:{{ elk_version }}"
|
||||
container_name: "{{ elk_elasticsearch_container_name }}"
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
- node.name={{ elk_elasticsearch_node_name }}
|
||||
- cluster.name={{ elk_elasticsearch_cluster_name }}
|
||||
- discovery.type=single-node
|
||||
- bootstrap.memory_lock=true
|
||||
- "ES_JAVA_OPTS=-Xms{{ elk_elasticsearch_heap_size }} -Xmx{{ elk_elasticsearch_heap_size }}"
|
||||
# xpack.security.enabled must be true whenever TLS is on - Elasticsearch
|
||||
# only honors xpack.security.http.ssl.* when security itself is
|
||||
# enabled. elk_effective_security_enabled captures that (it's true if
|
||||
# either elk_security_enabled or elk_tls_enabled is true). Whenever
|
||||
# security ends up on for either reason, ELASTIC_PASSWORD must also be
|
||||
# set - otherwise the image generates a random, unknown elastic
|
||||
# password and nothing else in this stack could authenticate.
|
||||
- xpack.security.enabled={{ elk_effective_security_enabled | lower }}
|
||||
{% if elk_effective_security_enabled %}
|
||||
- ELASTIC_PASSWORD={{ elk_elastic_password }}
|
||||
{% endif %}
|
||||
{% if elk_tls_enabled %}
|
||||
- xpack.security.http.ssl.enabled=true
|
||||
- xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/certs/{{ elk_tls_domain }}.crt
|
||||
- xpack.security.http.ssl.key=/usr/share/elasticsearch/config/certs/{{ elk_tls_domain }}.key
|
||||
- xpack.security.http.ssl.certificate_authorities=/usr/share/elasticsearch/config/certs/{{ elk_tls_domain }}.issuer.crt
|
||||
# Single node - transport SSL stays off. Turn this on (and add a
|
||||
# matching transport cert) if this ever becomes a multi-node cluster.
|
||||
- xpack.security.transport.ssl.enabled=false
|
||||
{% else %}
|
||||
- xpack.security.http.ssl.enabled=false
|
||||
- xpack.security.transport.ssl.enabled=false
|
||||
{% endif %}
|
||||
ulimits:
|
||||
memlock:
|
||||
soft: -1
|
||||
hard: -1
|
||||
volumes:
|
||||
- {{ elk_elasticsearch_data_volume }}:/usr/share/elasticsearch/data
|
||||
- {{ elk_base_dir }}/config/elasticsearch/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml:ro
|
||||
{% if elk_tls_enabled %}
|
||||
- {{ elk_lego_certs_dir }}:/usr/share/elasticsearch/config/certs:ro
|
||||
{% endif %}
|
||||
ports:
|
||||
- "{{ elk_elasticsearch_http_port }}:9200"
|
||||
- "{{ elk_elasticsearch_transport_port }}:9300"
|
||||
networks:
|
||||
{{ elk_network_name }}:
|
||||
{% if elk_tls_enabled %}
|
||||
aliases:
|
||||
- "{{ elk_tls_domain }}"
|
||||
{% endif %}
|
||||
healthcheck:
|
||||
test:
|
||||
- CMD-SHELL
|
||||
{% set es_scheme = 'https' if elk_tls_enabled else 'http' %}
|
||||
{% set curl_tls_flag = '-k ' if elk_tls_enabled else '' %}
|
||||
{# xpack.security.enabled follows elk_effective_security_enabled (see
|
||||
above), so basic auth is required here under that same condition. #}
|
||||
{% if elk_effective_security_enabled %}
|
||||
- "curl -s {{ curl_tls_flag }}-u elastic:{{ elk_elastic_password }} {{ es_scheme }}://localhost:9200/_cluster/health | grep -q '\"status\":\"green\"\\|\"status\":\"yellow\"'"
|
||||
{% else %}
|
||||
- "curl -s {{ curl_tls_flag }}{{ es_scheme }}://localhost:9200/_cluster/health | grep -q '\"status\":\"green\"\\|\"status\":\"yellow\"'"
|
||||
{% endif %}
|
||||
interval: 10s
|
||||
timeout: 10s
|
||||
retries: 20
|
||||
start_period: 30s
|
||||
|
||||
logstash:
|
||||
image: "{{ elk_docker_image_repo }}/logstash/logstash:{{ elk_version }}"
|
||||
container_name: "{{ elk_logstash_container_name }}"
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
- "LS_JAVA_OPTS=-Xms{{ elk_logstash_heap_size }} -Xmx{{ elk_logstash_heap_size }}"
|
||||
- xpack.monitoring.enabled=false
|
||||
{% if elk_effective_security_enabled %}
|
||||
- ELASTIC_USER=logstash_system
|
||||
- ELASTIC_PASSWORD={{ elk_logstash_system_password }}
|
||||
{% endif %}
|
||||
volumes:
|
||||
- {{ elk_base_dir }}/config/logstash/logstash.yml:/usr/share/logstash/config/logstash.yml:ro
|
||||
- {{ elk_base_dir }}/config/logstash/pipelines.yml:/usr/share/logstash/config/pipelines.yml:ro
|
||||
- {{ elk_base_dir }}/config/logstash/pipeline:/usr/share/logstash/pipeline:ro
|
||||
{% if elk_tls_enabled %}
|
||||
- {{ elk_lego_certs_dir }}:/usr/share/logstash/config/certs:ro
|
||||
{% endif %}
|
||||
ports:
|
||||
- "{{ elk_logstash_beats_port }}:5044"
|
||||
- "{{ elk_logstash_nginx_beats_port }}:5045"
|
||||
- "{{ elk_logstash_laravel_beats_port }}:5046"
|
||||
- "{{ elk_logstash_tcp_port }}:5000/tcp"
|
||||
- "{{ elk_logstash_udp_port }}:5000/udp"
|
||||
- "{{ elk_logstash_http_port }}:9600"
|
||||
networks:
|
||||
- {{ elk_network_name }}
|
||||
depends_on:
|
||||
elasticsearch:
|
||||
condition: service_healthy
|
||||
|
||||
kibana:
|
||||
image: "{{ elk_docker_image_repo }}/kibana/kibana:{{ elk_version }}"
|
||||
container_name: "{{ elk_kibana_container_name }}"
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
- SERVER_NAME={{ elk_kibana_container_name }}
|
||||
- ELASTICSEARCH_HOSTS={{ 'https' if elk_tls_enabled else 'http' }}://{{ elk_elasticsearch_client_host }}:9200
|
||||
{% if elk_effective_security_enabled %}
|
||||
- ELASTICSEARCH_USERNAME=kibana_system
|
||||
- ELASTICSEARCH_PASSWORD={{ elk_kibana_system_password }}
|
||||
- XPACK_SECURITY_ENCRYPTIONKEY={{ elk_kibana_encryption_key }}
|
||||
{% endif %}
|
||||
{% if elk_tls_enabled %}
|
||||
- SERVER_SSL_ENABLED=true
|
||||
- SERVER_SSL_CERTIFICATE=/usr/share/kibana/config/certs/{{ elk_tls_domain }}.crt
|
||||
- SERVER_SSL_KEY=/usr/share/kibana/config/certs/{{ elk_tls_domain }}.key
|
||||
# Public CA (Let's Encrypt) is already trusted by the container's
|
||||
# system trust store, so no custom CA needs to be supplied here for
|
||||
# the Elasticsearch connection.
|
||||
{% endif %}
|
||||
volumes:
|
||||
- {{ elk_base_dir }}/config/kibana/kibana.yml:/usr/share/kibana/config/kibana.yml:ro
|
||||
{% if elk_tls_enabled %}
|
||||
- {{ elk_lego_certs_dir }}:/usr/share/kibana/config/certs:ro
|
||||
{% endif %}
|
||||
ports:
|
||||
- "{{ elk_kibana_http_port }}:5601"
|
||||
networks:
|
||||
- {{ elk_network_name }}
|
||||
depends_on:
|
||||
elasticsearch:
|
||||
condition: service_healthy
|
||||
@@ -0,0 +1,29 @@
|
||||
# ansible_managed
|
||||
cluster.name: "{{ elk_elasticsearch_cluster_name }}"
|
||||
node.name: "{{ elk_elasticsearch_node_name }}"
|
||||
|
||||
network.host: 0.0.0.0
|
||||
discovery.type: single-node
|
||||
|
||||
# TLS (elk_tls_enabled) is a transport-layer concern independent of X-Pack
|
||||
# security (elk_security_enabled) - HOWEVER Elasticsearch only honors
|
||||
# xpack.security.http.ssl.* when xpack.security.enabled is true, so security
|
||||
# is force-enabled (elk_effective_security_enabled, set in tasks/main.yml)
|
||||
# whenever TLS is on, even if elk_security_enabled itself is false. The
|
||||
# ELASTIC_PASSWORD env var is set under the same condition (see
|
||||
# docker-compose.yml.j2), so basic auth is always usable whenever this is true.
|
||||
xpack.security.enabled: {{ elk_effective_security_enabled | lower }}
|
||||
{% if elk_tls_enabled %}
|
||||
xpack.security.http.ssl.enabled: true
|
||||
xpack.security.http.ssl.certificate: certs/{{ elk_tls_domain }}.crt
|
||||
xpack.security.http.ssl.key: certs/{{ elk_tls_domain }}.key
|
||||
xpack.security.http.ssl.certificate_authorities: ["certs/{{ elk_tls_domain }}.issuer.crt"]
|
||||
xpack.security.transport.ssl.enabled: false
|
||||
{% else %}
|
||||
xpack.security.http.ssl.enabled: false
|
||||
xpack.security.transport.ssl.enabled: false
|
||||
{% endif %}
|
||||
|
||||
# Reachable at {{ 'https' if elk_tls_enabled else 'http' }}://{{ elk_elasticsearch_client_host }}:9200 from other
|
||||
# containers on the {{ elk_network_name }} docker network, and from outside
|
||||
# the host at {{ 'https' if elk_tls_enabled else 'http' }}://{{ elk_tls_domain if elk_tls_enabled else elk_elasticsearch_client_host }}:{{ elk_elasticsearch_http_port }}
|
||||
@@ -1,272 +0,0 @@
|
||||
###################### Filebeat Configuration Example #########################
|
||||
|
||||
# This file is an example configuration file highlighting only the most common
|
||||
# options. The filebeat.reference.yml file from the same directory contains all the
|
||||
# supported options with more comments. You can use it as a reference.
|
||||
#
|
||||
# You can find the full configuration reference here:
|
||||
# https://www.elastic.co/guide/en/beats/filebeat/index.html
|
||||
|
||||
# For more available modules and options, please see the filebeat.reference.yml sample
|
||||
# configuration file.
|
||||
|
||||
# ============================== Filebeat inputs ===============================
|
||||
|
||||
filebeat.inputs:
|
||||
|
||||
# Each - is an input. Most options can be set at the input level, so
|
||||
# you can use different inputs for various configurations.
|
||||
# Below are the input specific configurations.
|
||||
|
||||
- type: log
|
||||
|
||||
# Change to true to enable this input configuration.
|
||||
enabled: false
|
||||
|
||||
# Paths that should be crawled and fetched. Glob based paths.
|
||||
paths:
|
||||
- /var/log/ngnix/*.log
|
||||
#- c:\programdata\elasticsearch\logs\*
|
||||
|
||||
# Exclude lines. A list of regular expressions to match. It drops the lines that are
|
||||
# matching any regular expression from the list.
|
||||
#exclude_lines: ['^DBG']
|
||||
|
||||
# Include lines. A list of regular expressions to match. It exports the lines that are
|
||||
# matching any regular expression from the list.
|
||||
#include_lines: ['^ERR', '^WARN']
|
||||
|
||||
# Exclude files. A list of regular expressions to match. Filebeat drops the files that
|
||||
# are matching any regular expression from the list. By default, no files are dropped.
|
||||
#exclude_files: ['.gz$']
|
||||
|
||||
# Optional additional fields. These fields can be freely picked
|
||||
# to add additional information to the crawled log files for filtering
|
||||
#fields:
|
||||
# level: debug
|
||||
# review: 1
|
||||
|
||||
### Multiline options
|
||||
|
||||
# Multiline can be used for log messages spanning multiple lines. This is common
|
||||
# for Java Stack Traces or C-Line Continuation
|
||||
|
||||
# The regexp Pattern that has to be matched. The example pattern matches all lines starting with [
|
||||
#multiline.pattern: ^\[
|
||||
|
||||
# Defines if the pattern set under pattern should be negated or not. Default is false.
|
||||
#multiline.negate: false
|
||||
|
||||
# Match can be set to "after" or "before". It is used to define if lines should be append to a pattern
|
||||
# that was (not) matched before or after or as long as a pattern is not matched based on negate.
|
||||
# Note: After is the equivalent to previous and before is the equivalent to to next in Logstash
|
||||
#multiline.match: after
|
||||
|
||||
# filestream is an input for collecting log messages from files. It is going to replace log input in the future.
|
||||
- type: filestream
|
||||
|
||||
# Change to true to enable this input configuration.
|
||||
enabled: true
|
||||
|
||||
# Paths that should be crawled and fetched. Glob based paths.
|
||||
paths:
|
||||
- /var/log/nginx/*.log
|
||||
#- c:\programdata\elasticsearch\logs\*
|
||||
|
||||
exclude_files: ['\.gz$']
|
||||
|
||||
# Exclude lines. A list of regular expressions to match. It drops the lines that are
|
||||
# matching any regular expression from the list.
|
||||
#exclude_lines: ['^DBG']
|
||||
|
||||
# Include lines. A list of regular expressions to match. It exports the lines that are
|
||||
# matching any regular expression from the list.
|
||||
#include_lines: ['^ERR', '^WARN']
|
||||
|
||||
# Exclude files. A list of regular expressions to match. Filebeat drops the files that
|
||||
# are matching any regular expression from the list. By default, no files are dropped.
|
||||
#prospector.scanner.exclude_files: ['.gz$']
|
||||
|
||||
# Optional additional fields. These fields can be freely picked
|
||||
# to add additional information to the crawled log files for filtering
|
||||
#fields:
|
||||
# level: debug
|
||||
# review: 1
|
||||
|
||||
# ============================== Filebeat modules ==============================
|
||||
|
||||
filebeat.config.modules:
|
||||
# Glob pattern for configuration loading
|
||||
path: ${path.config}/modules.d/*.yml
|
||||
|
||||
# Set to true to enable config reloading
|
||||
reload.enabled: false
|
||||
|
||||
# Period on which files under path should be checked for changes
|
||||
#reload.period: 10s
|
||||
|
||||
# ======================= Elasticsearch template setting =======================
|
||||
|
||||
setup.template.settings:
|
||||
index.number_of_shards: 1
|
||||
#index.codec: best_compression
|
||||
#_source.enabled: false
|
||||
|
||||
|
||||
# ================================== General ===================================
|
||||
|
||||
# The name of the shipper that publishes the network data. It can be used to group
|
||||
# all the transactions sent by a single shipper in the web interface.
|
||||
#name:
|
||||
|
||||
# The tags of the shipper are included in their own field with each
|
||||
# transaction published.
|
||||
#tags: ["service-X", "web-tier"]
|
||||
|
||||
# Optional fields that you can specify to add additional information to the
|
||||
# output.
|
||||
#fields:
|
||||
# env: staging
|
||||
|
||||
# ================================= Dashboards =================================
|
||||
# These settings control loading the sample dashboards to the Kibana index. Loading
|
||||
# the dashboards is disabled by default and can be enabled either by setting the
|
||||
# options here or by using the `setup` command.
|
||||
#setup.dashboards.enabled: false
|
||||
|
||||
# The URL from where to download the dashboards archive. By default this URL
|
||||
# has a value which is computed based on the Beat name and version. For released
|
||||
# versions, this URL points to the dashboard archive on the artifacts.elastic.co
|
||||
# website.
|
||||
#setup.dashboards.url:
|
||||
|
||||
# =================================== Kibana ===================================
|
||||
|
||||
# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
|
||||
# This requires a Kibana endpoint configuration.
|
||||
setup.kibana:
|
||||
|
||||
# Kibana Host
|
||||
# Scheme and port can be left out and will be set to the default (http and 5601)
|
||||
# In case you specify and additional path, the scheme is required: http://localhost:5601/path
|
||||
# IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
|
||||
#host: "localhost:5601"
|
||||
|
||||
# Kibana Space ID
|
||||
# ID of the Kibana Space into which the dashboards should be loaded. By default,
|
||||
# the Default Space will be used.
|
||||
#space.id:
|
||||
|
||||
# =============================== Elastic Cloud ================================
|
||||
|
||||
# These settings simplify using Filebeat with the Elastic Cloud (https://cloud.elastic.co/).
|
||||
|
||||
# The cloud.id setting overwrites the `output.elasticsearch.hosts` and
|
||||
# `setup.kibana.host` options.
|
||||
# You can find the `cloud.id` in the Elastic Cloud web UI.
|
||||
#cloud.id:
|
||||
|
||||
# The cloud.auth setting overwrites the `output.elasticsearch.username` and
|
||||
# `output.elasticsearch.password` settings. The format is `<user>:<pass>`.
|
||||
#cloud.auth:
|
||||
|
||||
# ================================== Outputs ===================================
|
||||
|
||||
# Configure what output to use when sending the data collected by the beat.
|
||||
|
||||
# ---------------------------- Elasticsearch Output ----------------------------
|
||||
# output.elasticsearch:
|
||||
# Array of hosts to connect to.
|
||||
# hosts: ["elastic.schleppe:9200"]
|
||||
|
||||
# Protocol - either `http` (default) or `https`.
|
||||
# protocol: "https"
|
||||
|
||||
# Authentication credentials - either API key or username/password.
|
||||
#api_key: "id:api_key"
|
||||
#username: "elastic"
|
||||
#password: "changeme"
|
||||
|
||||
# ------------------------------ Logstash Output -------------------------------
|
||||
output.logstash:
|
||||
# The Logstash hosts
|
||||
hosts: ["elasticsearch:5400"]
|
||||
|
||||
# Optional SSL. By default is off.
|
||||
# List of root certificates for HTTPS server verifications
|
||||
# ssl.certificate_authorities: ["/etc/elk-certs/elk-ssl.crt"]
|
||||
|
||||
# Certificate for SSL client authentication
|
||||
# ssl.certificate: "/etc/elk-certs/elk-ssl.crt"
|
||||
|
||||
# Client Certificate Key
|
||||
# ssl.key: "/etc/elk-certs/elk-ssl.key"
|
||||
|
||||
# ================================= Processors =================================
|
||||
processors:
|
||||
- add_host_metadata:
|
||||
when.not.contains.tags: forwarded
|
||||
- add_cloud_metadata: ~
|
||||
- add_docker_metadata: ~
|
||||
- add_kubernetes_metadata: ~
|
||||
|
||||
# ================================== Logging ===================================
|
||||
|
||||
# Sets log level. The default log level is info.
|
||||
# Available log levels are: error, warning, info, debug
|
||||
# logging.level: debug
|
||||
|
||||
# At debug level, you can selectively enable logging only for some components.
|
||||
# To enable all selectors use ["*"]. Examples of other selectors are "beat",
|
||||
# "publisher", "service".
|
||||
#logging.selectors: ["*"]
|
||||
|
||||
# ============================= X-Pack Monitoring ==============================
|
||||
# Filebeat can export internal metrics to a central Elasticsearch monitoring
|
||||
# cluster. This requires xpack monitoring to be enabled in Elasticsearch. The
|
||||
# reporting is disabled by default.
|
||||
|
||||
# Set to true to enable the monitoring reporter.
|
||||
#monitoring.enabled: false
|
||||
|
||||
# Sets the UUID of the Elasticsearch cluster under which monitoring data for this
|
||||
# Filebeat instance will appear in the Stack Monitoring UI. If output.elasticsearch
|
||||
# is enabled, the UUID is derived from the Elasticsearch cluster referenced by output.elasticsearch.
|
||||
#monitoring.cluster_uuid:
|
||||
|
||||
# Uncomment to send the metrics to Elasticsearch. Most settings from the
|
||||
# Elasticsearch output are accepted here as well.
|
||||
# Note that the settings should point to your Elasticsearch *monitoring* cluster.
|
||||
# Any setting that is not set is automatically inherited from the Elasticsearch
|
||||
# output configuration, so if you have the Elasticsearch output configured such
|
||||
# that it is pointing to your Elasticsearch monitoring cluster, you can simply
|
||||
# uncomment the following line.
|
||||
#monitoring.elasticsearch:
|
||||
|
||||
# ============================== Instrumentation ===============================
|
||||
|
||||
# Instrumentation support for the filebeat.
|
||||
#instrumentation:
|
||||
# Set to true to enable instrumentation of filebeat.
|
||||
#enabled: false
|
||||
|
||||
# Environment in which filebeat is running on (eg: staging, production, etc.)
|
||||
#environment: ""
|
||||
|
||||
# APM Server hosts to report instrumentation results to.
|
||||
#hosts:
|
||||
# - http://localhost:8200
|
||||
|
||||
# API Key for the APM Server(s).
|
||||
# If api_key is set then secret_token will be ignored.
|
||||
#api_key:
|
||||
|
||||
# Secret token for the APM Server(s).
|
||||
#secret_token:
|
||||
|
||||
|
||||
# ================================= Migration ==================================
|
||||
|
||||
# This allows to enable 6.7 migration aliases
|
||||
#migration.6_to_7.enabled: true
|
||||
|
||||
@@ -0,0 +1,28 @@
|
||||
# ansible_managed
|
||||
server.name: "{{ elk_kibana_container_name }}"
|
||||
server.host: "0.0.0.0"
|
||||
server.port: 5601
|
||||
|
||||
# Talk to Elasticsearch over the shared docker network using its service name.
|
||||
elasticsearch.hosts: ["{{ 'https' if elk_tls_enabled else 'http' }}://{{ elk_elasticsearch_client_host }}:9200"]
|
||||
|
||||
{% if elk_effective_security_enabled %}
|
||||
elasticsearch.username: "kibana_system"
|
||||
elasticsearch.password: "{{ elk_kibana_system_password }}"
|
||||
xpack.security.encryptionKey: "{{ elk_kibana_encryption_key }}"
|
||||
{% endif %}
|
||||
|
||||
{% if elk_tls_enabled %}
|
||||
server.ssl.enabled: true
|
||||
server.ssl.certificate: /usr/share/kibana/config/certs/{{ elk_tls_domain }}.crt
|
||||
server.ssl.key: /usr/share/kibana/config/certs/{{ elk_tls_domain }}.key
|
||||
|
||||
server.publicBaseUrl: "https://{{ elk_tls_domain }}:{{ elk_kibana_http_port }}"
|
||||
|
||||
# No elasticsearch.ssl.certificateAuthorities entry needed here: the cert
|
||||
# chain is issued by a public CA (Let's Encrypt) which the container's
|
||||
# default trust store already trusts.
|
||||
{% endif %}
|
||||
|
||||
monitoring.ui.container.elasticsearch.enabled: true
|
||||
i18n.locale: "en"
|
||||
@@ -0,0 +1,28 @@
|
||||
# ansible_managed
|
||||
[Unit]
|
||||
Description=Renew ELK TLS certificate via lego (Cloudflare DNS-01)
|
||||
After=network-online.target docker.service
|
||||
Wants=network-online.target
|
||||
Requires=docker.service
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
EnvironmentFile={{ elk_cloudflare_token_env_file }}
|
||||
ExecStart={{ elk_lego_install_dir }}/lego \
|
||||
--accept-tos \
|
||||
--email "{{ elk_tls_acme_email }}" \
|
||||
--server "{{ elk_tls_acme_server }}" \
|
||||
--domains "{{ elk_tls_domain }}" \
|
||||
--dns cloudflare \
|
||||
--path "{{ elk_lego_path }}" \
|
||||
--run-hook "/usr/bin/docker compose -f {{ elk_base_dir }}/docker-compose.yml -p {{ elk_compose_project_name }} restart elasticsearch kibana logstash" \
|
||||
renew --days {{ elk_tls_renew_days }}
|
||||
User=root
|
||||
StandardOutput=journal
|
||||
StandardError=journal
|
||||
SyslogIdentifier=lego-renew
|
||||
|
||||
# Light hardening. NoNewPrivileges/ProtectSystem kept loose enough that
|
||||
# lego can write certs under elk_lego_path and reach the docker socket
|
||||
# via the docker CLI.
|
||||
PrivateTmp=yes
|
||||
@@ -0,0 +1,11 @@
|
||||
# ansible_managed
|
||||
[Unit]
|
||||
Description=Daily timer for ELK TLS certificate renewal check (lego)
|
||||
|
||||
[Timer]
|
||||
OnCalendar=*-*-* {{ elk_tls_renew_on_calendar }}
|
||||
RandomizedDelaySec={{ elk_tls_renew_randomized_delay }}
|
||||
Persistent=true
|
||||
|
||||
[Install]
|
||||
WantedBy=timers.target
|
||||
@@ -1,17 +0,0 @@
|
||||
input {
|
||||
beats {
|
||||
port => 5045
|
||||
}
|
||||
}
|
||||
|
||||
filter {
|
||||
}
|
||||
|
||||
output {
|
||||
elasticsearch {
|
||||
index => "laravel-logs-%{+YYYY.MM}"
|
||||
hosts => "${ELASTIC_HOSTS}"
|
||||
user => "elastic"
|
||||
password => "${ELASTIC_PASSWORD}"
|
||||
}
|
||||
}
|
||||
@@ -1,24 +0,0 @@
|
||||
input {
|
||||
beats {
|
||||
port => 5044
|
||||
}
|
||||
}
|
||||
|
||||
filter {
|
||||
if [pipeline_id] == "nginx" {
|
||||
mutate { add_field => { "route" => "nginx_pipeline" } }
|
||||
} else if [pipeline_id] == "laravel" {
|
||||
mutate { add_field => { "route" => "laravel_pipeline" } }
|
||||
}
|
||||
}
|
||||
|
||||
output {
|
||||
if [pipeline_id] == "nginx" {
|
||||
pipeline { send_to => "nginx_pipeline" }
|
||||
} else if [pipeline_id] == "laravel" {
|
||||
pipeline { send_to => "laravel_pipeline" }
|
||||
} else {
|
||||
# Handle unknown cases
|
||||
stdout { codec => rubydebug }
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,6 @@
|
||||
# ansible_managed
|
||||
http.host: "0.0.0.0"
|
||||
http.port: 9600
|
||||
|
||||
path.config: /usr/share/logstash/pipeline
|
||||
xpack.monitoring.enabled: false
|
||||
@@ -0,0 +1,38 @@
|
||||
# ansible_managed
|
||||
input {
|
||||
beats {
|
||||
port => 5044
|
||||
}
|
||||
tcp {
|
||||
port => 5000
|
||||
codec => json_lines
|
||||
}
|
||||
udp {
|
||||
port => 5000
|
||||
codec => json_lines
|
||||
}
|
||||
}
|
||||
|
||||
filter {
|
||||
# Add filters here as needed (grok, mutate, date, etc.)
|
||||
}
|
||||
|
||||
output {
|
||||
elasticsearch {
|
||||
# Reach Elasticsearch over the shared docker network using its service name.
|
||||
hosts => ["{{ 'https' if elk_tls_enabled else 'http' }}://{{ elk_elasticsearch_client_host }}:9200"]
|
||||
{% if elk_effective_security_enabled %}
|
||||
user => "logstash_system"
|
||||
password => "{{ elk_logstash_system_password }}"
|
||||
{% endif %}
|
||||
{% if elk_tls_enabled %}
|
||||
ssl_enabled => true
|
||||
# Public CA (Let's Encrypt) - trusted by Logstash's default JVM trust
|
||||
# store already, no custom CA needs to be supplied here.
|
||||
{% endif %}
|
||||
index => "logstash-%{+YYYY.MM.dd}"
|
||||
}
|
||||
|
||||
# Uncomment for local debugging of pipeline output:
|
||||
# stdout { codec => rubydebug }
|
||||
}
|
||||
@@ -0,0 +1,26 @@
|
||||
# ansible_managed
|
||||
input {
|
||||
beats {
|
||||
port => 5046
|
||||
}
|
||||
}
|
||||
|
||||
filter {
|
||||
}
|
||||
|
||||
output {
|
||||
elasticsearch {
|
||||
# Reach Elasticsearch over the shared docker network using its service name.
|
||||
hosts => ["{{ 'https' if elk_tls_enabled else 'http' }}://{{ elk_elasticsearch_client_host }}:9200"]
|
||||
{% if elk_effective_security_enabled %}
|
||||
user => "logstash_system"
|
||||
password => "{{ elk_logstash_system_password }}"
|
||||
{% endif %}
|
||||
{% if elk_tls_enabled %}
|
||||
ssl_enabled => true
|
||||
# Public CA (Let's Encrypt) - trusted by Logstash's default JVM trust
|
||||
# store already, no custom CA needs to be supplied here.
|
||||
{% endif %}
|
||||
index => "laravel-logs-%{+YYYY.MM}"
|
||||
}
|
||||
}
|
||||
+13
-5
@@ -1,6 +1,7 @@
|
||||
# ansible_managed
|
||||
input {
|
||||
beats {
|
||||
port => 5044
|
||||
port => 5045
|
||||
}
|
||||
}
|
||||
|
||||
@@ -36,10 +37,17 @@ filter {
|
||||
|
||||
output {
|
||||
elasticsearch {
|
||||
# Reach Elasticsearch over the shared docker network using its service name.
|
||||
hosts => ["{{ 'https' if elk_tls_enabled else 'http' }}://{{ elk_elasticsearch_client_host }}:9200"]
|
||||
{% if elk_effective_security_enabled %}
|
||||
user => "logstash_system"
|
||||
password => "{{ elk_logstash_system_password }}"
|
||||
{% endif %}
|
||||
{% if elk_tls_enabled %}
|
||||
ssl_enabled => true
|
||||
# Public CA (Let's Encrypt) - trusted by Logstash's default JVM trust
|
||||
# store already, no custom CA needs to be supplied here.
|
||||
{% endif %}
|
||||
index => "weblogs-%{+YYYY.MM}"
|
||||
hosts => "${ELASTIC_HOSTS}"
|
||||
user => "elastic"
|
||||
password => "${ELASTIC_PASSWORD}"
|
||||
document_type => "nginx_logs"
|
||||
}
|
||||
}
|
||||
@@ -1,5 +1,9 @@
|
||||
# ansible_managed
|
||||
- pipeline.id: main
|
||||
path.config: "/usr/share/logstash/pipeline/main.conf"
|
||||
|
||||
- pipeline.id: nginx_pipeline
|
||||
path.config: "/usr/share/logstash/pipeline/nginx_pipeline.conf"
|
||||
path.config: "/usr/share/logstash/pipeline/pipeline-nginx.conf"
|
||||
|
||||
- pipeline.id: laravel_pipeline
|
||||
path.config: "/usr/share/logstash/pipeline/laravel_pipeline.conf"
|
||||
path.config: "/usr/share/logstash/pipeline/pipeline-laravel.conf"
|
||||
|
||||
Reference in New Issue
Block a user